Who we are and what this covers
Brightwave Products Inc. operates PackMagic. This policy describes personal information handled through our iOS app, public website, transactions, and support, including necessary records from earlier versions of the service. Contact support@packmagic.app with privacy questions or requests, or write to Brightwave Products Inc., 2311 Alexandra Road, Papillion, NE 68133, United States.
The public website provides information, policies, and a return page for app purchases made through Stripe Checkout. It does not register collector accounts or take payment-card details. Features depend on account eligibility and service availability; publication of this policy does not activate purchases, openings, Wheel, or shipping.
Account and contact information
The app signs you in with your phone number and a texted code through Supabase Auth and Twilio. We receive your phone number, account identifier, and authentication status. The code proves control of the number; it is not documentary identity or age verification. We collect and verify an email address when you choose shipping, and use supported verified contact information to handle your requests and outstanding claims. The current app does not offer Apple or Google account sign-in.
We keep your username and account status, collection and transaction information, and supported contact details. Eligibility records include the reported state, the terms version and time of agreement, and necessary references to eligibility decisions. Historical declarations remain historical records. You must be at least 18 to use PackMagic. Agreement to the terms is the only age requirement; signup does not collect a separate age declaration, date of birth, or identity-document image, and agreement is not verified age. If a specific fraud review, payment-provider condition, or applicable law requires additional information, we explain the request before you submit it.
When effective terms are presented for acceptance, we record the text and version you received, your authenticated agreement, its signup or action context, and the server time. Applicable policy references accompany new openings and shipping requests. Receipt of the privacy notice is recorded separately from agreement to the terms. It is not consent to optional marketing or tracking. We do not backdate agreement or treat a historical age declaration as agreement.
When you contact support, we receive your message, contact information, attachments you choose to send, and the order or account references needed to help you. Do not send passwords, sign-in codes, full payment-card numbers, or identity documents by ordinary email.
Collections, purchases, and shipping
We record Gem balances and funding sources, original paid-order attribution where established, payment and refund references, disputes, openings, disclosed odds and verification receipts, card entitlements, exchanges, rewards, and the versions of published Vault offers. These records support account recovery, result verification, payment and entitlement resolution, and necessary records from earlier versions of the service. Only PackMagic operators publish current Vault offers.
When checkout is available, payment details are entered with the payment processor. The implemented processor is Stripe. PackMagic receives transaction references, amounts, currency, and payment status; the app does not receive or store your full card number or security code. A processor can collect billing, device, and fraud-prevention information under its own privacy notice.
Checkout opens a Stripe-hosted page in your browser. Stripe can process billing, device, fraud-prevention, and checkout-interaction information under its own privacy notice. PackMagic records the payment amount, status, original-payment references, refunds, and disputes. Where applicable, delivery and tax processing also uses the shipping address and relevant card and shipping amounts.
For physical delivery, we collect the recipient name, street address, apartment or unit, city, state, ZIP code, selected cards, shipping quote, tracking information, delivery status, and related support records. When fulfillment-resolution services are available, these records can include dispatch commitments, sourcing issues, notices, your choice of a delay or replacement, and refund references. We use this information to quote, arrange, substantiate your instructions, and resolve shipments. A routine sourcing issue does not itself require an identity-document upload.
Phone verification codes authenticate sign-in. Routine shipping notices use your verified email address, and necessary support, refund, and closure notices use a supported verified contact channel. We retain send attempts and provider delivery, bounce, complaint, or failure references. A support instruction or privacy-notice acknowledgment is not marketing consent. The current app does not offer a separate automated service-text subscription.
Account visibility and earlier community records
The current app has no community Chat, public collector profiles, follower lists, collector image uploads, GIF picker, leaderboards, or collector-published Vaults. Your username identifies your account. Your collection, delivery address, verified contact, support requests, and account records are not published as a collector profile.
Necessary content, reports, and transaction references from an earlier version may remain under the retention criteria below. Removing a public view does not automatically make retained information anonymous or erase copies independently kept by other people.
Device, network, and local information
Our hosting and infrastructure providers process IP addresses, request times, requested resources, device or browser information, and operational or security logs. An IP address can indicate approximate location. The iPhone requests location permission after sign-in code verification and before username setup. Apple Core Location and reverse geocoding resolve one foreground fix to country and state. PackMagic receives the country, state, original fix time, and accuracy, and keeps a private reference linked to the relevant account. It does not receive precise coordinates or track device location in the background. Failed, denied, inaccurate, or blocked first-use checks remain retryable. Successful completion is remembered for the installation and reused across accounts without another GPS request on launch, foregrounding, checkout, or a timer. You can change permission in iOS Settings. Records and support remain accessible when new activity is restricted.
The server checks the saved state against its current approved-state list alongside account status, terms agreement, payment, suspension, closure, and feature restrictions. The saved report and its original time do not verify your current location, travel, or resistance to spoofing. PackMagic uses Apple GPS only. A shipping address and App Store country availability are not current-location checks.
The app stores sign-in session tokens in the iOS Keychain. It stores preferences, onboarding progress, and recovery information on your device. Demo cards, simulated balances, and demo progress stay on that device and do not become live awards. Network requests for remotely loaded content can still occur when you use the app.
The current app provides shipment history and supported email notices. It does not register a device for shipment push notifications. Historical device-registration records, where any remain, follow the retention and deletion criteria below.
Cookies and third-party media
The public website does not add behavioral advertising, marketing pixels, or an analytics program. Its fonts and brand artwork are served with the site. Hosting still processes the network information described above. The app uses local storage for its functions; Stripe Checkout and other linked websites may use their own cookies and have their own privacy notices.
Catalog artwork loads through Cloudflare. Fetching an image sends the information needed for network delivery, such as an IP address and the requested image URL. The current app does not load Chat GIFs or contact GIPHY for a GIF feed or picker.
PackMagic does not sell account information for money or operate a behavioral advertising program. Independent providers can use information under their own notices. Contact support to request an applicable opt-out of sale, sharing, or targeted advertising. The informational website has no advertising or analytics tags to disable. Do Not Track and legally recognized opt-out signals are different; applicable opt-out rights still govern covered processing.
How we use information
We use information to authenticate accounts, maintain collections and balances, check eligibility, settle and verify openings, process purchases and refunds, arrange shipping, deliver requested service messages, answer support and privacy requests, prevent fraud and duplicate claims, secure the service, diagnose failures, keep necessary business records, and comply with applicable law.
Information needed for an account, payment, eligibility decision, or delivery is necessary to complete that action. Support attachments and other details you choose to provide are optional unless needed to resolve the specific request. PackMagic does not use this information to train a general-purpose AI model.
Who receives information
Supabase supplies authentication, database, and backend services. Cloudflare R2 stores catalog artwork and Cloudflare delivers images to your device. Vercel hosts the public website and operator console. Twilio verifies sign-in phone numbers. Stripe hosts checkout and processes payments. Amazon Web Services, including Amazon SES, sends service emails and processes delivery, bounce, and complaint events. Apple provides the location services described above.
The current app does not accept collector profile-photo or banner uploads or send collector images for automated screening. Any retained content from an earlier version follows the retention criteria below. Adding a new upload or community feature requires a review of its collection, safeguards, and disclosures before it becomes available.
PackMagic orders cards through sellers on TCGplayer for receipt by PackMagic, then packs and ships them to you. Carriers receive the destination and delivery information needed to transport and resolve your shipment. Authorized staff and support providers access information needed for their work; necessary supplier, sourcing, and carrier records can support a delivery or remedy.
Service providers processing information on our behalf must protect it consistently with this policy and applicable law and use it only for authorized purposes. Independent services, including carriers, sign-in providers, payment processors, and media providers, can have their own practices, legal duties, and retention requirements.
We may disclose information where reasonably necessary to comply with a lawful request, protect people and property, investigate fraud, establish or defend legal claims, or carry out a corporate transaction with appropriate confidentiality protections. We may also share information at your direction.
Retention and deletion
We retain account information while needed to provide the service and handle the obligations described in this policy. Retention decisions consider the record's purpose, outstanding cards or balances, shipments, disputes, security needs, applicable law, and provider requirements. These reasons apply to the relevant records and do not justify keeping unrelated personal information indefinitely.
When completing a deletion request, we remove sign-in access and unrelated username, profile, address, preference, and device data. Unnecessary historical community content is assessed under the same criteria. Necessary settlement contact, active delivery addresses, and unresolved card or payment claims remain in restricted records until resolved. We can retain a private account reference and necessary transaction, opening, payment, fulfillment, deletion, and audit evidence for the purposes described here. Retained identifiers or historical text can still be personal information; they are not automatically anonymous.
Our target is to remove sign-in access and unrelated personal data within 30 calendar days of a verified deletion request, subject to any shorter applicable deadline. Outstanding claims may continue separately. We keep each retained record only while needed for its stated purpose, an applicable recordkeeping duty, or a specific dispute or legal hold. Financial and fulfillment evidence supports accounting, refunds, delivery, and disputes; security records support investigation of incidents. We restrict access to necessary staff and delete or de-identify records when their reason for retention ends. Backup copies follow the relevant provider's deletion cycle and are not a reason to restore deleted account access. We do not promise immediate deletion of every backup or independently held provider record.
Deleting data from PackMagic does not necessarily erase copies independently retained by providers or other people. We will apply legally required deletion instructions and explain any applicable exception when handling your request.
Your choices and privacy requests
You can view your collection, shipments, opening receipts, and supported account records in Profile. Use Profile, Support requests, then Privacy & records to request access, correction, deletion, or an appeal. The app can prepare pages of records for you to share; contact support for a complete access response. To remove account access, choose Delete account in Profile, review the retained assets, and confirm Delete account. If you cannot access the app, email support@packmagic.app.
Depending on your location and which laws apply to PackMagic, you may have rights to know about processing, access or obtain a portable copy of information, correct or delete it, and opt out of sale, sharing, targeted advertising, or qualifying profiling. Applicable state laws may also provide an appeal, an authorized-agent process, rights concerning sensitive information, or a recognized universal opt-out signal. Statutory coverage and exceptions govern these rights.
Send a request to support@packmagic.app with the subject Privacy request and enough information to identify your account and request. We may verify identity or an agent's authority using information appropriate to the request. We will not ask for your password or a sign-in code by email. We will respond within the applicable legal deadline and explain a denial or extension. If you disagree with a decision, reply with Privacy appeal so we can review it. We will not penalize you for exercising an applicable privacy right.
Children, security, and processing locations
PackMagic is for collectors aged 18 or older, or any higher age required by applicable law for an offered feature. It is not directed to children, and we do not knowingly permit anyone under 18 to create an account. If you believe a minor supplied personal information, contact support so we can investigate and take appropriate restriction and deletion steps. Handling a minor's account does not permit automatic confiscation of earned cards or disregard of required payment remedies.
We use access controls and technical safeguards appropriate to the service. No storage or transmission system is guaranteed secure. Protect your device and account, and tell us if you suspect unauthorized access.
PackMagic is designed for supported locations in the United States. Our providers may process information in the United States and other countries where they operate. Access to the informational website does not establish eligibility for the app or announce app availability in other markets.
Changes and contact
The effective date appears at the top of the published policy. We will identify later revisions and give additional notice of material changes where appropriate or required. Where consent is required, we will ask for it. Contact Brightwave Products Inc. at support@packmagic.app with privacy questions or requests.